project-analyzer

SUSPICIOUS. The core repo-analysis behavior is coherent and mostly local, but the embedded fallback instruction to install another third-party skill introduces unnecessary transitive trust beyond the stated purpose. No direct credential harvesting or exfiltration is present, yet the cross-skill installation path materially increases supply-chain risk.